Privacy Policy — ug303

Definitions

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "ug303" — the online betting platform operated at ug303.app, including all associated products, games, customer support channels, and back-office systems.
• "Platform" — the ug303 website accessible at https://ug303.app and any mobile browser-optimised version of that website.
• "Member" / "you" — any individual who has registered an account on ug303.app, or any visitor who accesses the Platform without registering.
• "Personal Data" — any information that relates to an identified or identifiable natural person. This includes, but is not limited to, name, email address, phone number, date of birth, payment details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, storage, use, disclosure, erasure, and destruction.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. For all data collected via ug303.app, ug303 acts as the Controller.
• "Processor" — a third party that processes Personal Data on behalf of ug303 in accordance with ug303's documented instructions (e.g., payment gateway providers, cloud hosting services).
• "KYC" — Know Your Customer, the identity and document verification process required to confirm a Member's identity and comply with fraud-prevention obligations.

Data We Collect

ug303 collects Personal Data through the following channels: account registration, ongoing platform usage, KYC verification, payment transactions, customer support interactions, and automated technical mechanisms such as cookies. The categories of data we collect are described in the table below:

We do not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for identity verification purposes beyond what is strictly required for age and identity confirmation under our KYC obligations.

How We Use Your Data

ug303 uses the Personal Data we collect for the following purposes. Each purpose is supported by a lawful basis as described in Section 4:

• Account Administration: Creating, maintaining, and managing your Member account, including identity verification, password resets, account security alerts, and profile updates.
• Service Delivery: Providing access to all ug303 products — sportsbook markets, live casino games, slot gacor titles, togel (Indonesia's traditional numbers lottery) draws, virtual sports, and card games — and processing all associated wagers and transactions.
• Payment Processing: Facilitating deposits and withdrawals via Indonesian bank transfers (BCA, BRI, BNI, Mandiri, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), verifying payment method ownership, and maintaining transaction records.
• KYC & Fraud Prevention: Verifying your identity, confirming your age (21+), screening against fraud watchlists, detecting and preventing money laundering, and ensuring that funds deposited onto the platform are legitimately sourced.
• Responsible Gaming: Monitoring betting patterns to identify signs of problem gambling, enforcing deposit limits and self-exclusion orders, and proactively contacting Members whose activity raises concern.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality and compliance purposes.
• Legal & Regulatory Compliance: Meeting applicable legal obligations, including record-keeping requirements, responding to lawful requests from regulatory or law-enforcement authorities, and enforcing our Terms & Conditions.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how Members interact with the Platform, identify technical issues, and improve features, game selection, and user experience.
• Marketing Communications: Sending promotional emails, bonus notifications, and seasonal campaign communications (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day promotions) to Members who have not opted out of marketing. You may unsubscribe at any time by contacting [email protected].
• Security Monitoring: Detecting and responding to unauthorised access attempts, suspicious login activity, and other threats to Platform integrity and Member account security.

Legal Basis for Processing

ug303 processes your Personal Data only where a valid legal basis exists. The primary legal bases we rely on are:

• Contractual Necessity: Processing that is necessary to perform the contract between you and ug303 — including account creation, game access, payment processing, and customer support. Without this processing, ug303 cannot provide the services you have registered for.
• Legal Obligation: Processing required to comply with applicable legal obligations, including KYC identity verification, anti-money-laundering record-keeping, and responding to lawful regulatory or law-enforcement requests.
• Legitimate Interests: Processing that serves ug303's legitimate business interests, provided that these interests are not overridden by your fundamental privacy rights. This includes fraud prevention and security monitoring, platform analytics, and responsible gaming oversight.
• Consent: Where we rely on your consent — such as for marketing communications or optional cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Consent withdrawal requests should be directed to [email protected].

Where processing is based on legitimate interests, ug303 conducts a balancing test to ensure that our interests do not unduly override your right to privacy. Records of these assessments are maintained internally and available upon request.

Cookies & Tracking Technologies

ug303 uses cookies and similar tracking technologies on ug303.app to ensure the Platform operates correctly, to remember your preferences, and to collect analytics data that helps us improve our service. The categories of cookies we use are:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable core features such as session management, login authentication, and security token validation. They cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Collect anonymised or pseudonymised data about how visitors use ug303.app — including which pages are visited most frequently, how long sessions last, and where users navigate from. This data is used in aggregate form to improve Platform performance and content relevance.
• Functionality Cookies: Remember your preferences and settings — such as your preferred display language, time-zone offset (WIB, WITA, or WIT), and previously used payment method — to personalise your experience on return visits.
• Marketing & Targeting Cookies: Used (with your consent) to deliver promotional content that is relevant to your interests and betting history. These cookies may record visits to specific game categories or promotional pages to inform the types of offers you receive.

You may manage your cookie preferences through your browser settings. Blocking strictly necessary cookies may prevent you from using certain features of the Platform. For all other cookie categories, you may withdraw consent at any time by adjusting browser settings or contacting support.

Sharing Your Data

ug303 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: We share Financial Data with licensed Indonesian payment processors and banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposit and withdrawal transactions. These parties act as Processors under binding data-processing agreements.
• KYC & Identity Verification Providers: We may share Identity Data and KYC documentation with accredited identity verification service providers who assist us in confirming Member identities and fulfilling our age-verification (21+) and anti-fraud obligations.
• Game Content Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive pseudonymised session identifiers and wagering data necessary to deliver their games through the ug303 Platform. These providers do not receive your name, contact details, or full financial data.
• Cloud Infrastructure & Hosting: Personal Data is stored on secure cloud servers operated by ug303's hosting partners. These partners process data strictly on ug303's instructions under confidentiality and data-processing agreements.
• Legal & Regulatory Authorities: ug303 may disclose Personal Data to government agencies, law-enforcement authorities, or regulatory bodies where required by applicable law, court order, or regulatory mandate. ug303 will notify affected Members of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of ug303's assets, Member Personal Data may be transferred to the acquirer as part of the transaction, subject to the acquirer assuming the privacy obligations set out in this Policy.

All third parties who receive Personal Data from ug303 are required to process that data in a manner consistent with this Privacy Policy and applicable data protection law. ug303 maintains a register of data-sharing arrangements and reviews these periodically.

Data Retention

ug303 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your membership and for a minimum of five (5) years following account closure, in order to comply with anti-money-laundering record-keeping obligations and to handle any post-closure disputes or regulatory inquiries.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial record-keeping requirements.
• KYC Documentation: Retained for the duration of your membership and for five (5) years following account closure or the date of the last verification event, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the support interaction, unless the interaction relates to an ongoing dispute, in which case records are retained until the dispute is fully resolved plus one (1) year.
• Marketing Consent Records: Retained for the duration of your membership or until you withdraw consent, plus two (2) years thereafter as evidence of the consent or its withdrawal.
• Analytics & Technical Data: Retained in anonymised or aggregated form indefinitely for platform improvement purposes. Pseudonymised technical logs are deleted or anonymised after twenty-four (24) months.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. You may request early deletion of certain data categories — see Section 9 for your rights in this regard.

Data Security

ug303 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-Bit SSL Encryption: All data transmitted between your browser and ug303.app is encrypted using industry-standard 256-bit SSL/TLS protocols. This protects your account credentials, payment details, and personal information in transit.
• Encrypted Data Storage: Sensitive data — including passwords (stored as salted cryptographic hashes), financial records, and KYC documentation — is encrypted at rest on ug303's secure servers.
• Access Controls: Access to systems containing Personal Data is restricted to authorised ug303 personnel and contractors on a strictly need-to-know basis. All access is logged, monitored, and subject to regular review.
• Two-Factor Authentication: ug303 supports and encourages the use of two-factor authentication (2FA) for Member accounts to provide an additional layer of protection beyond username and password.
• Penetration Testing & Vulnerability Assessments: ug303 conducts regular security assessments of the Platform to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ug303 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, ug303 will notify affected Members without undue delay.

While ug303 employs industry-leading security practices, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials. If you believe your account has been compromised, contact [email protected] immediately.

Your Rights

As a Member of ug303 and a data subject whose Personal Data we process, you have the following rights with respect to your information. These rights may be subject to limitations where processing is required to fulfil legal obligations or protect legitimate interests:

• Right of Access: You have the right to request a copy of the Personal Data that ug303 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. Where possible, you may update certain information directly through your account profile.
• Right to Erasure: You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to our legal obligations to retain certain records (see Section 7).
• Right to Restrict Processing: You have the right to request that ug303 restricts the processing of your Personal Data in certain circumstances — for example, while we investigate the accuracy of data you have contested.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes; once you object, we will cease marketing communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• Right Not to be Subject to Automated Decisions: You have the right not to be subject to decisions made solely by automated processing — including profiling — where those decisions produce legal or similarly significant effects on you, unless such processing is necessary for a contract or is authorised by applicable law.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". ug303 will respond within thirty (30) calendar days of receiving a valid, verified request. We may ask you to verify your identity before processing your request to prevent unauthorised disclosure.

Children's Privacy

The ug303 Platform is intended exclusively for adults aged 21 and over. ug303 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that Personal Data has been collected from a person under 21 — whether through misrepresentation at registration or any other means — we will immediately close the associated account, delete all associated Personal Data, and return any deposited funds to the payment method used.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account on ug303.app, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

ug303 encourages parents and guardians to make use of internet filtering and parental-control tools to prevent minors from accessing online gambling platforms. Further guidance on protecting younger family members from gambling content is available through our Responsible Gaming page.

International Data Transfers

ug303 operates primarily with servers and infrastructure located in regions with robust data protection frameworks. In some circumstances, Personal Data may be transferred to, stored in, or processed in countries outside of Indonesia — for example, where cloud hosting partners or game-content providers maintain data centres in other jurisdictions.

When Personal Data is transferred internationally, ug303 takes appropriate safeguards to ensure that your data continues to receive a level of protection consistent with this Privacy Policy. These safeguards may include:

• Entering into standard contractual clauses or data-processing agreements with the receiving entity that impose equivalent data protection obligations.
• Transferring data only to organisations that operate within jurisdictions recognised as providing an adequate level of data protection.
• Applying technical safeguards such as end-to-end encryption to data in transit during international transfers.

By using the ug303 Platform, you acknowledge that your Personal Data may be transferred internationally in the circumstances described above. If you have questions about the specific safeguards applied to any particular transfer, contact [email protected].

Third-Party Links

The ug303 Platform may contain references to third-party game providers and payment services whose own privacy practices are governed by their respective privacy policies. ug303 is not responsible for the privacy practices of these third parties, and this Privacy Policy applies solely to Personal Data collected and processed by ug303 in its capacity as Controller.

We recommend that you review the privacy policies of any third-party service you interact with in connection with your ug303 account — including your bank (BCA, BRI, BNI, Mandiri, etc.) and e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) — to understand how they handle your data.

Amendments to this Policy

ug303 reserves the right to update or amend this Privacy Policy at any time. When material changes are made — particularly those that affect how we collect, use, or share your Personal Data — we will notify registered Members by email to the address on their account and/or by displaying a prominent notice on the Platform for a reasonable period before the changes take effect.

The "Last Updated" date at the top of this page reflects the date on which the current version became effective. We encourage you to review this Privacy Policy periodically to stay informed of how ug303 protects your data. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy.

The current version of this Privacy Policy is always available at ug303.app/privacy-policy.

Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or ug303's data processing practices, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Enquiry" or "Data Rights Request" as appropriate
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays
• Languages: English and Indonesian (Bahasa Indonesia) — native Indonesian-speaking agents are available at all times
• Response Time: ug303 aims to acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within thirty (30) calendar days

If you are not satisfied with ug303's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or regulator in your jurisdiction. ug303 will cooperate fully with any such regulatory inquiry.